macOS README: restart-path bisect result

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XsESshRCoBoUVWV9qKURUF

lib/images/macos/README.md

@@ -92,10 +92,18 @@ VirtualSMC-only, PE install — 3 of 3 builds completed:
 | 2   | 26      | 7            | 1             | 1                       | 0             |
 | 3   | 26      | 7            | 1             | 1                       | 0             |
 
-What still happens: a kernel panic at one of the guest's own reboots during the
+What still happens: at roughly one in ten guest-initiated reboots the guest
-install (GPF in launchd's context right after `MACH Reboot`). XNU reboots
+either panics (GPF in launchd/kernel_task context shortly after `MACH Reboot`
-itself within seconds and the install continues; the driver only intervenes
+or within the first 15 s of the next boot — tmpfs/APFS/zone corruption
-if no kernel comes back within 60 s. Known, logged, not yet root-caused.
+signatures, i.e. memory or register state, not one driver) or never comes back
+(dead after `IOPlatformHaltRestartAction`). XNU reboots itself after a panic;
+the driver resets a dead guest after 60 s, so builds complete. A device bisect
+(`tools`-style 10–30 PE reboots per variant: VMware SVGA vs std VGA, no HDA,
+EHCI input, 1 vCPU) showed the rate is independent of the emulated devices and
+of SMP; Haswell-noTSX does not boot Tahoe. Host: AMD Zen 4, kvm_amd, Intel
+Skylake-Client vCPU model — the FPU-context-switch panic points at XSAVE state
+handling on that combination. Not fixed; a `vmix run` VM that hangs on Restart
+must be reset from the host.
 
 ## Debugging